<!DOCTYPE html>
<html>
<body>
Test passes if it does not crash.
<style>
#test1 {
    display: table-cell;
    content: counter(c);
    counter-reset: c;
    width: 1000px;
    height: 1000px;
}
#test1::after {
    content: counter(c);
    counter-reset: c;
}
#test2 {
    -webkit-flow-into: a;
}
#test2::before {
    content: counter(c);
    counter-reset: c;
}
</style>
<script>
if (window.layoutTestController) {
    layoutTestController.dumpAsText();
    layoutTestController.waitUntilDone();
}

function crash() {
    test1 = document.createElement('div');
    test1.setAttribute('id', 'test1');
    document.body.appendChild(test1);
    test2 = document.createElement('div'); 
    test2.setAttribute('id', 'test2');
    test1.appendChild(test2);
    document.body.offsetTop;
    document.body.style.zoom = 2;
	if (window.layoutTestController) {
	    GCController.collect();
        eventSender.mouseMoveTo(500, 500);
        layoutTestController.notifyDone();
	}
}
window.onload = crash;
</script>
</body>
</html>